The Internal Revenue Service’s plans to upgrade its workstations and servers to newer versions of Windows led to years-long delays, according to a new government report.
The
TIGTA found, at the conclusion of its fieldwork for the report, that the IRS had not accounted for the location or migration status of approximately 1,300 workstations and upgraded only about one-half of its Windows servers from the 2003 software version to the 2008 release. Since April 2011 when the IRS initially started the Windows workstation upgrade project, the IRS spent approximately $128 million to upgrade its Windows workstations and expects to spend an additional $11 million through the end of fiscal year 2015. TIGTA claimed the IRS did not follow established policies over project management and provided inadequate oversight and monitoring of the Windows XP upgrade early in its effort.
TIGTA recommended that the IRS’s chief technology officer ensure that all workstations have been adequately accounted for and upgraded to Windows 7; ensure that enterprise-wide information technology maintenance and upgrade efforts going forward follow the Enterprise Life Cycle, as prescribed by IRS policy, to mitigate potential delays and to ensure project transparency and accountability; and require appropriate Executive Steering Committees to oversee enterprise-wide information technology maintenance and upgrade efforts with regular project reviews and executive approvals.
The IRS agreed with two recommendations. First, the IRS said it has accounted for all workstations that need to be upgraded to Windows 7 and plans to track them until completed. Second, the IRS plans to ensure that enterprise wide upgrade efforts receive adequate oversight.
The IRS partially agreed with TIGTA’s recommendation that large-scale upgrade projects should follow the Enterprise Life Cycle. It disagreed that all upgrade efforts should follow the Enterprise Life Cycle but agreed that large-scale, enterprise-wide efforts need to have a set of well documented minimum project documentation requirements to ensure that effective project management is adhered to for projects of this size.
IRS CTO Terence V. Milholland disagreed with several of the points raised by TIGTA in a response accompanying the report. “The audit incorrectly concludes that IRS has not accounted for all XP workstations,” he wrote. “We acknowledge there were challenges with our inventory data due to the many antiquated systems in our IT ecosystem. In spite of this, we took extraordinary steps to identify, document and upgrade every XP workstation in the IRS. On several occasions throughout the audit, the IRS provided information to the TIGTA team that clearly documented the number of workstations to be upgraded, where those workstations were located, and our strategy to complete the upgrades. Although, footnoted in the report, TIGTA opted not to change their assertion that the IRS had not accounted for all XP workstations. As of this date, only 71 Windows XP workstations remain to be migrated. Risks on these workstations have been mitigated and upgrades will be completed by the end of this calendar year.”
He also contended that the IRS had followed the appropriate project management policies, and he disagreed with TIGTA’s conclusion that the IRS did not take appropriate steps to ensure the security of the XP workstations during the upgrades.